Identity Threat Detection & Response (ITDR)

Overview

Identity Threat Detection & Response (ITDR) watches the identity infrastructure itself (Active Directory domain controllers, AD FS and AD CS, Entra ID, Okta and the sessions they issue) for attacks that use valid credentials, such as Kerberoasting, Golden Ticket, DCSync/DCShadow, password spraying, MFA fatigue and AiTM session-token theft, and responds by disabling accounts, forcing MFA or blocking risky logins in the authentication path. Most products pair detection with identity posture and attack-path analysis. It sits beside the IdP and MFA layer (IAM / SSO / MFA), credential vaulting (PAM), access reviews (IGA), general behaviour analytics (UEBA), network sensors (NDR) and decoy-led Deception, which are separate atlas areas. Licensing is per active identity or per user, often bundled into Microsoft 365 E5, Duo or EDR suites, while specialists are quote-only. Open source covers attack-path mapping (BloodHound CE, Adalanche) but not real-time detection and response.

Valid-credential attacks look like normal logins to perimeter and endpoint tools; worth it once MFA and EDR are in place, and often already licensed.

Advantages

• Catches attacks that use valid credentials (Kerberoasting, Golden Ticket, DCSync, password spraying, AiTM token theft) that look like normal logins to perimeter and endpoint tools
• Often already licensed: Defender for Identity ships in Microsoft 365 E5 and EMS E5, Cisco Identity Intelligence in Duo Advantage/Premier, ITDR in SentinelOne's Commercial bundle
• Response can go beyond alerts: Silverfort blocks or MFA-challenges logins inline, and CrowdStrike can automatically enforce MFA or password resets
• Attack-path and posture tools (BloodHound, Purple Knight, PingCastle) find Tier 0 exposure before it is abused, with free or open-source starting points
• Directory rollback and forest recovery (Semperis, Netwrix) shorten recovery after an AD compromise

Trade-offs

• Sensor-based tools (e.g. Defender for Identity) run on domain controllers and AD FS/AD CS/Entra Connect servers, so the tool itself becomes Tier 0 software to patch and change-control
• No single product covers everything: AD-protocol depth, cloud-IdP session coverage and browser-level token theft usually come from different vendors
• Strongest inside a platform (Defender XDR, Falcon, Singularity, Duo); standalone specialists are mostly quote-only
• Inline blocking can lock out real users or service accounts if a policy is wrong, so rollouts need staging
• Behavioural detections need a learning period (Microsoft cites about three weeks) and tuning around admin tools and service accounts

Open-source option

BloodHound Community Edition (Apache-2.0) and Adalanche (AGPL-3.0) are actively maintained open-source attack-path tools for AD and Entra ID, but no maintained open-source project does real-time identity threat detection and response; teams usually build that from SIEM rules on domain-controller logs. PingCastle's source is published under NPOSL-3.0 but Netwrix requires a paid licence for commercial services, and Semperis' Purple Knight is free but proprietary.

Vendors & tools in this area

Last updated 2026-10-24 · Next refresh 2026-10-26 (weekly) · Changelog